Optimizing Your Company Right Out of Business

Optimizing Your Company Right Out of Business

Optimizing Your Company Professional athletes know the importance of developing opposing or complementary muscles (quadriceps and hamstrings, biceps and triceps).  These complementary muscles are sets of muscles that “work together” to move your body in the most efficient ways. If these muscles are strengthened together, it
Using Machine Learning To Find Employees Who Can Scale With Your Business

Using Machine Learning To Find Employees Who Can Scale With Your Business

Machine Learning To Find Employees Hiring managers in search of qualified job candidates who can scale with and contribute to their growing businesses are facing a crisis today. They’re not finding the right or in many cases, any candidates at all using resumes alone, Applicant

System Vulnerabilities Are an Issue for Everyone

Over the past decade, we have seen a drastic increase in the number of companies relying on cloud services. Given the nature of the cloud as a shared-resource environment, threats that infiltrate the system of a single provider can have a widespread impact on others that are partnered with the cloud service providers. Unfortunately, any vulnerability found in a CSP’s system is a vulnerability for the end user’s environment as well.

The more data that users have spread out in the cloud environment, the greater the attack surface is. There are always going to be vulnerabilities associated with denial of service, weak password selections, insecure application program interfaces, and agnostic vulnerabilities.

Every user on the cloud could become an entry point for intrusion, which is why it is important that all users share the responsibility of ensuring their systems are protected. Fortunately, enterprise security leaders are able to reduce the risk by maintaining an ongoing inventory of all assets and keeping the system up-to-date.

The 3 Cloud Service Models

Right now, the cloud environment is mainly composed of three service models. These models are software as a service (SaaS), infrastructure as a service (IaaS), and platform as a service (PaaS). Unfortunately, we are seeing the greatest rise in vulnerabilities in PaaS systems.

It is estimated that close to 90 percent of enterprises using IaaS will also use serverless PaaS by the year 2021. Unfortunately, 80 percent of successful attacks on serverless PaaS systems will result from immature tools and processes resulting from the use of vulnerable codes or misconfiguration.

The online environment is changing so quickly that we are now producing software at a much faster rate. The downside is that we are unable to fully test security systems to ensure all vulnerabilities are secured. Additionally, the software is becoming far more complex.

Instead of going to one cloud environment, users are able to access and authenticate services through other systems in order to push files and data into cloud applications. The concept of using these DevOps tools is being overlooked by traditional enterprise security systems more often. Typical systems are not reviewing these tools as thoroughly as they should. Instead, they are reviewing the systems and not diving deep enough into them.

What Needs to Be Done

It is imperative to look at security issues in the same manner as you would a software defect in the system. Keeping systems up-to-date and having mechanisms to inventory assets in your ecosystem are often overlooked when managing vulnerabilities.

One step toward improving security is by changing the mindset of DevOps. Change DevOps to DevSecOps, for starters, and make automated security check gates throughout the entire program. This will ensure you are thinking about security throughout the entire life cycle.

The DevSecOps team is responsible for more than just developing code. These professionals need to implement measures to ensure security. Define this team as an integral part of the organizational structure, and talk about the DevSecOps process.

Across the board, you need to make sure you have and know the checkpoints within the system. The more automated your system is, the more likely people are to follow checkpoints. Create alerts that prompt individuals to revisit and recode areas if they do not follow the checkpoints. An automated system will ensure users are unable to push information into the production environment without the checkpoints.

Next, implement DevSecOps automation and orchestration tools to help out. Having tools available will ensure team members have the ability to automate complex tasks, allowing them to review what matters most to security. Check these orchestration tools for how they access your environment such as which access keys, accounts, API tokens, and other secrets create backdoors.

Implement secret account and key rotation management systems quarterly, biannually, or annually. Block all tools in the environment and start new. The goal is to regularly refresh your environment and not allow it to become stale. Managing this regularly lowers the risk of malware in accounts.

Know the tools that are available to you. Review what your team is using, and keep a thorough inventory to ensure your tools are up-to-date. Finally, ensure you are performing routing configuration management. Baseline security hardening ensures you have a standard template to use. Routinely updating and protecting the system is a crucial part of preventing system vulnerabilities. As you continually refresh the environment, you are always pulling on baseline hardening.

By developing a DevSecOps team at your company, you can implement all these practices in order to secure your system. Without a doubt, technology is developing at the speed of light. It is important that you are proactive in ensuring your security measures are top-of-the-line and effective.

By Brad Thies

Brad Thies

Brad Thies is the founder and president of BARR Advisory, an assurance and advisory firm specializing in cybersecurity, risk management, and compliance. Brad speaks regularly at industry events such as ISACA conferences, and he is a member of AICPA’s Trust Information Integrity Task Force. Brad’s advice has been featured in Entrepreneur, Small Business CEO, and Information Security Buzz. Prior to founding BARR, Brad managed KPMG's risk consulting division. He is a CPA and CISA.

View Website

BRANDED COMICS FOR YOUR NEXT CAMPAIGN

Get in touch with us regarding our introductory rates!

A Look Beyond the Basics of Cloud Database Services: What’s Next for DBaaS?

A Look Beyond the Basics of Cloud Database Services: What’s Next for DBaaS?

Cloud Database Services When it comes to choosing the right database management system (DBMS), developers and data analysts today face ...
Google Cloud Platform: Enabling APIs

Google Cloud Platform: Enabling APIs

Enabling Google APIs The Google Cloud Platform is a comprehensive tool that helps companies manage their IT resources. Completing software ...
Technology Cloud Contributor

The Competitive Cloud Data Center

The Competitive Cloud The corporate data center was long the defacto vehicle for all application deployment across an enterprise. Whether ...
Infosec thought leaders

Cryptocurrencies and Ransomware: How VDI Can Help Defend Against the Next Ransomware Attack

Cryptocurrencies and Ransomware The WannaCry ransomware made headlines back in May when it crippled hospitals across the UK and put ...
What Skills Do I Need to Become a Data Scientist?

What Skills Do I Need to Become a Data Scientist?

Becoming a Data Scientist Leveraging the use of big data, as an insight-generating engine, has driven the demand for data ...

Pure Storage’s Evergreen Storage Program – A Marketing Solution to Engineering Problems

/
Pure Storage (“Pure”) makes a lot of noise about their Evergreen Storage program.  With bold claims like “never rebuy a TB you’ve purchased, never do a data migration again and never do another forklift ...

From kids' music to the tech world, without missing a beat

/
Matan Ariel’s young nieces and nephew live on the other side of the world, but they keep up with their uncle thanks to his music—and thanks to Google, too. Though they live in Israel and ...

A 360 View of the IoT Landscape Three Years Later

/
The general IoT environment has transformed since I joined the Dell Technologies OEM & IoT team over three years ago. While many of my colleagues focus on specific vertical industries like manufacturing, telco or ...